There is even a way to verify that the same code produces the same binary regardless of the git revision with:

There is even a way to verify that the same code produces the same binary regardless of the git revision with:

−

make BUILD_TIMELESS=1

+

$ make BUILD_TIMELESS=1

However reproducible builds isn't sufficient to verify that you are really running the binary you flashed:

However reproducible builds isn't sufficient to verify that you are really running the binary you flashed:

Line 39:

Line 39:

Dumping the flash chip externally is strongly advised for that, since some chipsets makes it too easy for the SMM code to give back (to Flashrom) a binary than differs from the one in the flash chip. The same chipset mechanism also makes it too easy to write a modified version to the flash.

Dumping the flash chip externally is strongly advised for that, since some chipsets makes it too easy for the SMM code to give back (to Flashrom) a binary than differs from the one in the flash chip. The same chipset mechanism also makes it too easy to write a modified version to the flash.

−

If you do not trust the computer dumping the flash externally and can't setup proper flash write protection ([patchwork.coreboot.org/project/flashrom/list/ patches for it were not merged yet at the time of writing]) you can get around that by verifying the flash chip content with unrelated computers, while keeping the computer you read the flash from offline. This way no computer can predict if it will be the last to verify the flash chip, and so covertly modifying it will be risky since it can be detected.

+

If you do not trust the computer dumping the flash externally and can't setup proper flash write protection ([https://patchwork.coreboot.org/project/flashrom/list/ patches for it were not merged yet at the time of writing]) you can get around that by verifying the flash chip content with unrelated computers, while keeping the computer you read the flash from offline. This way no computer can predict if it will be the last to verify the flash chip, and so covertly modifying it will be risky since it can be detected.

Introduction

This page explains how Coreboot can help with various security aspects of your system, compared to proprietary/closed-source boot firmware implementations(BIOS/EFI/UEFI). It doesn't however address issues such as the Intel Management Engine or AMD PSP.

Free software

Coreboot

Note that while Coreboot itself is free software, many boards still use blobs. Some however don't require any. If so they are typically supported by Libreboot, a coreboot distribution.

Security fixes

Fixes can take months before being available on non-free firwmares, if you are lucky enough to have them.
With free software boot fimrwares, security issues can be fixed, and in coreboot many are.

Security fixes are usually mentioned in Coreboot ChangeLog on the blog.

Using proprietary software parts in Coreboot, such as proprietary RAM initialization, will make you dependent on the producer of that software to fix security issues affecting it.

You still can get fixes or fix yourself issues that affects the free software part.

Integrating back the vendor fixes might be faster than with proprietary vendor BIOSes.

However the vendor might not do such fixes for older hardware, and access to the source code might be required to fix the issue.

Auditable code

Because the boot firmware is the first code that executes on the main CPU, it's an interesting target for rootkits:

The code that runs first has to load what runs next, so it can patch it. That patch can then in turn patch what's next and so on.

The code that runs first can setup SMM on X86 or TrustZone on some ARM SOCs. SMM/Trust zone are more powerful than ring0. On x86 devices, non-free boot firmwares have a tendency to put a lot of code to run in SMM. In contrast Coreboot keep it to a minimum.

Being stored in a flash chip, separately from the OS and its data, non-free boot firmware have a tendency not to be updated by the end user, nor reflashed externally. That permits a very high persistence.

Given the above, being able to know what your boot firmware does is very important.

Reproducible builds

Coreboot has reproducible builds. That permits to verify that a given binary corresponds to a given source code. This should work out of the box.

There is even a way to verify that the same code produces the same binary regardless of the git revision with:

$ make BUILD_TIMELESS=1

However reproducible builds isn't sufficient to verify that you are really running the binary you flashed:

Dumping the flash chip externally is strongly advised for that, since some chipsets makes it too easy for the SMM code to give back (to Flashrom) a binary than differs from the one in the flash chip. The same chipset mechanism also makes it too easy to write a modified version to the flash.

If you do not trust the computer dumping the flash externally and can't setup proper flash write protection (patches for it were not merged yet at the time of writing) you can get around that by verifying the flash chip content with unrelated computers, while keeping the computer you read the flash from offline. This way no computer can predict if it will be the last to verify the flash chip, and so covertly modifying it will be risky since it can be detected.

Existing security features

Given that, with coreboot, the hardware initialization is separated from the boot logic, many security features only makes sense when implemented in payloads. Nevertheless, coreboot implement some security features.

Encryption

DMA is often understood as a way to access the RAM independently of the CPU.[4]
However, DMA is, in a more broad context, just a way to do "memory to memory" transfers. That might not involve the main CPU RAM at all, like with SATA's DMA.

Ideas

RAM wiping after each boot

This is not very useful: The most interesting time would be right before power-off, which could be implemented in SMM. Unfortunately a cautious attacker just pulls the plug.

To prevent reading data after a reboot, a payload could be adapted to clean out memory. Using applications that manage sensible data sensibly (ie. wipe after use) is still a better solution.

Protecting against DMA attacks

At boot, the RAM isn't initialized nor functional. This is the boot fimrware's task.
Having a free software boot firmware gives us the opportunity to try to never leave the system RAM unprotected from such attacks. The idea would be to try to initialize the IOMMU before activating the RAM.